Which PHP version does your WordPress site run?

Read the version from the dashboard

Tools → Site Health → Info → Server. The panel lists the PHP version, the web server, the limits and the extensions. It also states the version WordPress recommends, which is a cleaner guide than the minimum in the readme.

With WP-CLI, if your host gives you shell access:

wp --info | grep -i php
wp eval 'echo PHP_VERSION, PHP_EOL;'
wp core check-update

On the server, the answer has to come from the binary your site is served by, not from a terminal on your laptop:

php -v
ls /etc/php                       # Debian/Ubuntu: which branches exist
grep -r 'fastcgi_pass\|proxy_pass' /etc/nginx/sites-enabled/ | grep php

The last command is the one people skip. On a server with two or three PHP branches installed — very common on panels — the site uses one specific socket, and updating another branch changes nothing.

Can a visitor see it?

Usually not. WordPress does not print the PHP version into pages, and PHP's own X-Powered-By header is often stripped by the host or a caching plugin. When you check from outside with curl -sI https://yoursite.com/, an empty result means hidden, not absent.

What an outside check can still find on a WordPress site, and why it matters:

• The version, when the host leaves expose_php on — then the report compares it to the fixed builds for this month's RCEs.
• A reachable phpinfo() or debug page — the most common way a WordPress site publishes its exact build, usually from a leftover test file.
• An open readme.html, wp-config.php.bak or .env — not the PHP version, but the same class of mistake and often a direct path to the database password.

Update PHP without breaking the site

1. Snapshot first. Files and database — a one-click staging copy on most managed hosts, or a manual dump plus an archive.
2. Switch to the next branch, not the newest. 8.2 → 8.3 is a testable change; 8.1 → 8.5 is a project. PHP's migration guides list every deprecation per branch.
3. Test on staging with the plugins you actually use. The failures are usually one abandoned plugin calling a removed function, or a theme using dynamic properties that PHP now warns about.
4. Check the PHP extensions after the switch — mysqli, gd, imagick, intl, zip, curl. A missing extension shows up as a white screen or a broken image pipeline, not as an error about PHP.
5. Flip the version in the panel (or the FPM pool), open the site, the admin and a form submission. Then re-run an outside check.

Managed WordPress hosts often expose this as a dropdown per site. Shared hosts sometimes cap the branch — if the selector stops at an old version, ask support for the number they actually run, and treat the answer as a hosting decision, not a WordPress one.

Why this month's PHP bugs bypass WordPress security

Security plugins, login hardening, WAF rules and file-integrity checks all operate inside WordPress — after PHP has parsed the request. CVE-2026-109618 and CVE-2026-109619 execute while PHP is still setting the request up. Nothing in wp-content is in the path, and no plugin can see the request before it is processed.

The patch is the PHP build: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. If you are on a branch that reached end of life — 8.1 or older — there is no package, and the upgrade becomes the fix.